AI Threads

Community Platform

The AI section of the console lets you ask questions about your inventory, build reports, export data, draw charts and diagrams, and write custom integration scripts in a conversation. It lives at AI threads in the console navigation, and has three tabs: Threads (your conversations), Artifacts (the saved output), and Reporting (guided report templates).

An AI thread is a private conversation between one user and the AI: no other user can see your threads, ever. What you choose to share is the artifact — the report, table, script, or other output a thread produces — never the conversation itself.

Requirements

• The account must have the AI entitlement, and AI must be enabled in the account (or organization) AI configuration. When AI is turned off, the composer is locked and the page says so; superusers are linked to the AI configuration.
• An organization must be selected in the organization picker. A thread records the organization scope that was active when it was created, and the AI’s searches never reach beyond that scope. The My Organizations options does work with AI threads, but keep in mind that anyone you share an artifact with must have the same accessible organization permissions.
• Runs are also subject to the account’s AI token budget; when a daily budget or token cap is exhausted, new runs are refused until it resets.

Threads

Starting a thread

A thread starts from any of these places:

• the New thread composer on the threads page;
• the New AI thread button in the top bar;
• the command palette (Cmd/Ctrl+K), which can start a thread carrying the context of the page you are on;
• Ask AI handoffs from inventory pages — asset details, vulnerability and software groups, and similar views — which start the thread scoped to that object. A Context chip on the composer shows the scope, and can be removed before the first question to ask about the whole organization;
• the Reporting tab, where picking a guided report and answering its scoping questions starts a thread that generates the report;
• generating a custom integration script — each authoring run appears as a live turn on its own thread.

In the composer, Enter sends and Shift+Enter inserts a newline. A new thread is titled from your prompt, and after the first answer the AI replaces that with a short generated title; renaming a thread yourself stops the automatic titling.

The thread list

Threads are grouped by recency — Today, Yesterday, Earlier this week, Earlier this month, Older — and sorted by last activity. Each row shows a running indicator when a turn is in flight, an icon for the thread’s newest artifact, the relative time of the last activity, when the thread expires, and the organizations it spans. The search box matches thread titles, prompts, and responses; press / to focus it.

The list shows the threads whose organization scope overlaps your current organization selection. When you have threads outside that scope, a footer note says so and offers to switch to My Organizations.

Reading a thread

Every turn shows your prompt, a work log of the steps the AI took — searches it ran, data it read — and a summary line with the elapsed time, token usage, tool calls, and the artifacts it produced. The Normal view folds the work log away; Verbose expands every step. The answer itself is saved as an artifact and shown as a linked card; the newest one opens automatically in the artifact panel beside the conversation.

Background execution

A run is independent of your browser: closing the tab, navigating away, or losing the network does not stop it. Reopening the thread re-attaches to the run and replays everything that streamed while you were away, and the command palette lists running AI jobs so you can jump back to them. Only Stop ends a run early — it returns your prompt to the composer — and a chat turn otherwise runs up to 5 minutes, a report turn up to 10.

Renaming and deleting

Rename a thread with the pencil beside its title (titles are capped at 120 characters). Deleting a thread permanently removes the conversation and every unshared artifact it produced, along with their attached files; shared artifacts are kept. A thread with a running turn cannot be deleted until the run finishes or is stopped. There is no way to share a thread — share its artifacts instead.

Organization scope

A thread can only be continued by its owner, with an organization selection that still contains every organization the thread was created against. Switching to a different organization, or losing access to one of the thread’s organizations, blocks new turns until the selection (or access) is restored; the existing conversation stays readable.

Artifacts

Everything a thread produces is saved as an artifact: the answer document itself, plus any tables, charts, diagrams, or scripts it generated along the way. Artifacts are the durable, shareable output of the AI — a thread expires, but an artifact you share does not.

The Artifacts tab lists yours and the ones other people have shared with your organizations, searchable by title, kind, and author, with Created by me and Created by other people filters. Selecting one shows the content and its provenance: who created it, when, from which organizations, with which model, its size, and when it expires.

Artifact kinds

Large inline tables and code blocks inside a report are carved into attached files — downloadable resources listed with the artifact — so a big export does not bloat the document. A single turn can produce up to 100 artifacts, each up to 512 KiB.

Viewing and exporting

HTML reports carry their own toolbar with Print / PDF, an HTML download, and Open (full screen in a new tab). Prose artifacts offer Markdown, HTML, and PDF exports; file artifacts (data and scripts) download as their original file. Every artifact can be renamed by its creator (up to 160 characters).

Sharing and privacy

Every artifact starts private to its creator. Sharing one makes it visible to every user who can read all of the organizations it was created from; Copy link (available once shared) produces a link that opens it in the Artifacts tab. Unsharing returns it to private.

The creator can always delete their own artifact. A shared artifact can also be deleted by a superuser or by an administrator of every organization in its scope. Deletion is permanent, removes attached files, and removes the artifact for everyone.

Use in custom integration

A Starlark script artifact — typically the product of the AI script generator — has a Use in custom integration action that loads the script back into the integration it was written for, or into a new one. It requires the custom integration entitlements in addition to AI.

Reporting

The Reporting tab is a gallery of guided report templates — such as End-of-Life OS Analysis, Rogue & Unmanaged Assets, Critical Systems & Blast Radius, and Internet Exposure — each with optional scoping questions. Start report thread opens a new thread that generates the report, so the result arrives as an artifact you can review before opening or sharing it.

Limits

• At most 4 AI runs per user and 12 per account may run at once, and one per thread.
• A single request (a prompt and its context) is capped at 64 KiB.
• A chat turn runs up to 5 minutes; a guided report turn up to 10 minutes.
• One turn can produce at most 100 artifacts, 512 KiB each and 2 MiB in total.

Retention

AI data has fixed retention windows, separate from the organization-level data retention settings:

• Threads are removed 180 days after their last use. Every update pushes the clock back 180 days, so an active thread never expires and an abandoned one is removed half a year after it was abandoned. Renaming a thread does not reset the clock. Thread rows show the countdown — expires in N days within 30 days, a date beyond that.
• Unshared artifacts expire with their thread. When a thread expires or is deleted, the unshared artifacts it produced are removed with it, attached files included.
• Shared artifacts are kept indefinitely while shared. Unsharing one restores the thread-derived expiry; deleting it removes it immediately.
• Run records are temporary. The job record and streamed event log behind a run are kept about 15 minutes while running and 24 hours after the run ends; the durable results are the thread and its artifacts.

Cleanup runs daily, and expired items disappear from the console at their expiry time. These windows are not configurable; you can delete individual threads and artifacts at any time.